CVE-2026-85190

Quick Index, a table-of-contents extension for Joomla from Regular Labs, fails to escape the configurable class option before inserting it into a generated HTML attribute in versions before 5.0.5. A user with high privileges, such as a trusted author or editor who can enter plugin syntax, can craft a class value that closes the intended attribute and injects a new attribute (for example an event handler), which then executes in the browsers of site visitors or other users viewing the page. Joomla's built-in content filtering cannot reliably block this because Quick Index constructs the executable HTML after the authored plugin syntax has already passed through the filter. The flaw is rated high severity (CVSS 4.0: 7.5) but requires an authenticated, privileged account, so it is most dangerous on sites where content authors are not fully trusted. No public proof of concept is known, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

What to do: Upgrade Quick Index to version 5.0.5 or later, which escapes class values before HTML generation. Until patched, restrict which Joomla user groups can create content or enter plugin syntax, and review existing Quick Index plugin tags for class values containing quotes, angle brackets, or 'on'-prefixed event names that could break out of the attribute. Also inspect rendered pages and server logs for suspicious injected attributes or anomalous session activity from privileged accounts.